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In order to improve the key rate of the decoy-state method, we need to jointly study yields of 
different bases. Given the delicate fact that pulses of the same preparation state can have different 
counting rates if they are measured in different bases, for example, those vacuum pulses and those 
single-photon pulses, existing results of decoy-state quantum key distribution using biased bases are 
actually flawed by assuming that they are equal. We fix this flaw through using the idea that yields 
of pulses prepared in different bases are same provided that they are prepared in the same state 
and also they are measured in the same basis, for example, those single-photon pulses prepared 
in different bases but measured in the same basis. Based on this, we present correct formulas 
for the decoy-state method using biased bases. Taking the effects of statistical fluctuations into 
account, we then numerically study the key rates of different protocols with all parameters being 
fully optimized. Our result confirms the prior art conclusion that decoy-state method using biased 
bases can have advantage to the symmetric protocol with unbiased bases. We obtain high key rates 
of our 4-intensity protocol (two in X bases and two in Z bases) without using any vacuum source. 

PACS numbers: 03.67.Dd, 42.81.Gs, 03.67.Hk 


I. INTRODUCTION 

Quantum key distribution (QKD) is one of the most successful applications of quantum information processing. 
It can help two remote parties, commonly noted as Alice and Bob, to set up the unconditionally secure key. The 
security of QKD is based on the fundamental laws of quantum physics [I|, , rather than unproven of computational 

complexity assumptions. 

In practice, imperfect single-photon sources are used in most of the real setups of QKD [H-Q. Such iimlementations, 
in principle, suffer from the photon-number-splitting (PNS) attack Sll- The decoy-state method and some 

other methods [IMl can be used for unconditionally secure QKD even if Alice only uses the imperfect sources an. 

The central issue in the decoy-state method is to faithfully estimate the yield of single-photon pulses. If we do 
this estimation in each bases separately, i.e., only use those observed outcome of pulses prepared and measured in 
the same basis, we can obtain two different values of yields, one for the X basis, one for the Z basis. In such a way, 
results will be faithful but the key rate are not optimized. We can improve the key rate by using the observed results 
in different bases jointly, however, there are delicate points we must pay attention to. 

In fact, pulses of the same preparation state can have different counting rates if they are measured in different 
bases, for example, those vacuum pulses and those single-photon pulses. This point is not considered in all previous 
biased-basis methods [20l - [^ . In this paper, we point out that yields of pulses prepared in different bases are same if 
they are prepared in the same state and measured in the same basis, for example, those single-photon pulses. This 
is to say, we can treat those measurement outcome from different preparation bases jointly provided that they are 
measured in the same basis. Based on this, we present correct formulas for the decoy-state method using biased bases. 
We also consider the effects of statistical fluctuations. 

In order to make a good estimation of the final key rate with the decoy-state methods, we need to find out the 
lower and upper bounds of the yield sq caused by the vacuum state first. These bounds can be easily obtained if we 
assume that Alice can prepare a vacuum source. However, in practice, the different intensities are usually generated 
with an intensity modulator, which has a finite extinction ratio. So it is usually difficult to create a perfect vacuum 
state in decoy-state QKD experiments [l^ . In this paper, we also make a study on the decoy-state method without 
using vacuum. This is particularly important for the practical implementations. 

Regarding the yield sq of the vacuum state as a common variable, the final key rate is a function of sq. There is 
a possible region for this values. To extract the final secret key, we should find out the worst-case key rate over the 
whole region of sq values. While in some previous works 2l|,[23, they straightly use the lower bound of sq to calculate 
the final key rate. Actually, in some cases shown in Sec. IIIIl we find that the smallest value of the final key rate does 
not appear with the lower bound of sq. In this case, if we simple mindedly calculate the final key rate with the lower 
bound of soj the security of the decoy-state method will not be guaranteed. 
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The rest of this paper is organized as follows. In Sec. HU we review some delicate points of the decoy-state method. 
Subsequently, we show the correct formulas to estimate the lower bound of Si and the upper bound of ei with the 
effect of statistical fluctuations being taken into account. After that, in Sec. uni we numerically study the optimized 
key rates of different protocols. The article is ended in Sec. IIVI with a concluding remark. 


II. SOME DELICATE POINTS OF THE DECOY-STATE METHOD AND THE CORRECT FORMULAS 


Consider the case we use two bases for state preparation and measurement, the Z basis and the A basis. We denote 
for the yield of those single-photon pulses which are prepared in the a basis and measured in the w basis. Note 
that the state of single-photon pulses prepared in the Z basis is same with state of single-photon pulses prepared in 
the X basis. The density matrix of both states are simply 1/2. We also denote Sq as the yield of those vacuum pulses 
which are measured in the w basis. The delicate point is that even in the asymptotic case 

Sq ¥= Sq , ( 1 ) 

and 

®i,c( ( 2 ) 

These are different from the assumptions in prior art works such as where one simply chose to do the decoy-state 
analysis only in Z basis and then just used the value of sf ^ for the value s//x- The reason sf ^ ^ i® simply 
due to the mismatch of detection efficiencies and dark counts in different bases. Such mismatch can come from either 
imperfect control two the devices inside Labs, or Eve’s attack [23l - l^ . If we do the decoy-state study in each basis 
separately with unbiased bases, we can obtain the lower bound values in each bases separately for sf ^ sf^x- The 
results are faithful but the key rate will be low. Note that here we must use Sq and Sq separately in calculating sf ^ 
and sf^x- 

Here we have a better treatment and we can still study the decoy-state method jointly in different bases. For this 
goal, we shall use the observed number of counts of pulses prepared in one basis but measured in another basis. In 
particular, we have the following elementary equalities 
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Here, sf^(a,u} = Z,X) is the yield of those single-photon pulses which are prepared in the a basis and measured in 
the w basis. Eqs. (HU are the main idea of this paper. Given these equations, we don’t have to study the decoy-state 
method completely separately in each bases. For example, consider a protocol using a vacuum source O, one source 
Xi in the X basis and two sources {Zj\j = 1,2} in the Z basis. Observing Sq and = 1,2} we can formulate 

the yield of single-photon pulses measured in the Z basis and also the yield of single-photon pulses measured in the X 
basis. Here Sq is the yield of the vacuum source measured in the w basis and S%. is the yield of source Zj measured 
in the oj basis. Using the observed values {S^. |j = 1, 2} and Sq. Asymptotically we have 
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where = 00 ,^ 102,22 “ oo, 22 '^ 2 , 2 i, ^ 2^23 = 01 , 2102,22 “ 01 , 2202,21 and ak,Zj are non-negative parameters 

of sources Zj with pz^ = l^)(^l' Here uj can take both X and A. Given Eqs. ([31 0]), the error rate of 

single-photon pulses prepared and measured in the X basis is 

X/ x,u — oo,Xi sjf /2 Tx — gq^XiSq/2 

ei <ei’ =--=-XT-’ 

ai,XiSi,x aiAi®i ,2 

where Tx_^ are error yield of the source Ai measured in the X basis, ak,Xi are non-negative parameters of source Ai 
with pxi = 'Z,k^k,Xi\k){k\ and the lower bound sf'^ is given by Eq. ([S]) already. Note that our formulas Eqs. ([SI 
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ED are unconditionally correct under whatever situation, e.g., detection efficiency mismatch, no matter it comes from 
the imperfect control in side Lab. or Eve.’s attack outside Lab [234^ . 

Most generally, Alice can use several different sources. We assume Alice prepares the vacuum source O, 2 non¬ 
vacuum sources in the Z basis, Z\,Zi and 2 different non-vacuum sources in the A basis Xi,X 2 with probabilities 
Po, PZi, PZ 2 and pxi, px 2 Respectively. The density matrices of these non-vacuum sources in photon number space 
are denoted as follows 

(7) 

k 


where ak,ai are non-negative parameters and a can be the Z and X bases. Meanwhile, we introduce the following 
very important conditions for two different sources ai and 02 

Oi Oq 

'^2 /o\ 

— — 5 

ak ,ai Oi ,q:i Oo ,0.1 

for all k > 2. We denote ai -< 02 when the sources ai and 02 fulfill the relations presented in Eq.®. Imperfect 
sources used in practice such as the coherent state source, the heralded source out of the parametric-down conversion, 
satisfy the above conditions. 

In the protocol, we also assume that Bob measures the received pulses in the Z and X bases with probabilities 
and respectively. After the preparation and measurement of Nt pulses, Alice and Bob obtain the observable 

and which are the number of successful counts and error counts when Alice sends the pulses from source 
aj and Bob measures them in the co basis (when preparation basis and measured basis are different, we do not need 
error counts). Here a and oj can take both X and Z. We also denote S'^. and T^. as the yield and error yield 
respectively with S'^. = N^J{pa^q^Nt) and T^. = {pa^q^Nt). As shown, we have the normalized relations 

PO + ELi PZi + ELi PXr = 1 and q^ + q^ = I. 

Following the GLLP security analysis Q, the final key rate for the source pzi is given by 

R = PZN^ {ai.zAf [1 - H{e{’^)] - , (9) 


if the source is not used for error test. Here pzN^ is the raw data sift factor, including the basis-sift factor q^ and 
the signal-state ratio pzi ; sf and are the yield and phase error rate of the single-photon state measured in the 
Z basis; fe is the efficiency factor of the error-correction method used; Szi and Ez^ are the yield and quantum bit 
error rate of the source Zi measured in the Z basis; H{x) = —a;log 2 (x) — (1 — x) log 2 (l — x) is the binary Shannon 
entropy function. The phase error rate e^’ can be estimated from the error rate in the X basis while it can not be 
measured directly. 

In any real experiment, the total pulses sent by Alice is finite. In order to extract the secret final key, we have 
to consider the effect of statistical fluctuations caused by the finite-size. In this case, yields of the same state out of 
different sources are not always rigorously equal to each other, i.e. ¥= ^k a 2 - Here s‘^ aj yield of fc-photon 

pulses prepared from source aj and measured in the w basis. To obtain the lower bound of sf, one can implement the 
idea of Ref. [l^, i.e. using the averaged yield of a specific state from different sources. As shown, one can introduce 
the averaged value for the yield of /c-photon pulses from all sources that are prepared in the same state and measured 
in the same basis. We define 
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where c% = J2iPZiak,z, +ErPAafeAr(* = 0>1) and = Ej (fc > 2). With Eq. ([10]), we have (sf x) = 

{sf 2 ) for fc = 0,1. Therefore we shall omit subscript a there for fc = 0,1 and use notations {sf), {sf} for {sf^}, {sf^} 
for simplicity. Also, we define quantity 
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Considering the relations in Eq. m prepared in the a basis and measured in the a; basis, we can lower bound 
(s^ for a given value of (sg) with the following equations [Tsj l 


«„)>(sr)= niax 

Q: = Z,A L 


and 
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where = ao.aia 2 ,Q 2 - oq, 0202 , 01 , ^ 01^02 = oi, 0102,02 - 01 , 0202,01 and 


(13) 
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(15) 


^oi = S-J{1 + <5-), = S-J{1 - <5-). 

By using the multiplicative form of Chernoff bound 113 , 111 , with a fixed failure probability e, we can give an interval 
of {S'^.) with the observable S'^., [^oji'^'oi], which can bound the value of {S‘^.) with a probability at least 1 — e. 
Similarly, we can also define with the observable Note that (s“’^) is actually a function of (sg)- 
With the mean values (s“’^) defined in Eq. (fT^ . the lower bounds of sf 2 , and be estimated by 

- <5z,), = (sf’^)(l - (16) 

where Szi = A/ \J Al^xS^i'z) A = \/—2\ne and Sx^ = \J ^i,Xr ) ■ Here and after, we define 

N^,^^=ak,c.,Pc,q^Nu (17) 

as the number of fc-photon pulses prepared in source aj and measured in the basis w. 

In order to estimate the final key rate, we also need the upper bound of the error rate . Similarly, we have 


X ^ X,U _ ^Xi ~ ®0,Xi(So )(1 “'^O.Xi)/2 
ei.Xi S e-i^Xi — x,L ’ 

Ol.XiSi.Xi 


(18) 


where S^x^ = \J■ 

If the key size is infinite, the phase-flip error rate for single-photon counts in Z basis is simply = e^. In a finite- 
key-size case, we can apply the large data size approximation of the random sampling method [30l| to upper bound 
the phase error rate of single-photon pulses prepared and measured in the Z basis with the failure probability e 


p,Z , p,Z,U x,u 
e\ <e{ ’ =ei:x. 


gX 
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(19) 


where 6 »f = ^Jng|de with dg = ^ ng = - \og[tyJei{l - e\)nxnzl(nx + nz)]/(nx+nz) and gx = nx+nz ' 

Here we write nx = N^Xi^ = ^i^Xi ^r simplicity. Note that is a function of {sq). 

Straightly, we can also formulate the upper bound of the phase-flip error rate of single-photon counts in X basis, 
being denoted by . We omit the explicit formula here since it is just trivially written analogically to Eq. (HU). 

Note that (s^) (or (sf)) is the common variable in both quantity {s^’^) and (or quantity (sf’^) and 

shown in Eq. m and Eq. m respectively. We need to know the range of this for final key calculation. 

If Alice uses a vacuum source in the protocol, the bounds are simply 

^o = (5o’'')>(so)>(5o’^)=^S- ( 20 ) 

However, in practice, it is usually difficult to create a perfect vacuum state in decoy-state QKD experiments [T3| . 
We may consider the decoy-state methods without using a vacuum source. In the method, Ea. (l20l) can not be used 
directly. 

Reconsidering the relations in Eq. (TT^ with j = 1, 2, we can lower bound (sg) by eliminating (s^q.) 
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where = ao^aiCii,a 2 ~ Oo,a 2 «i.ai- With these preparations, in the method without the assumption of vacuum, 

we can write the lower bound of (sg) as 

(sg) > {so’^) = max^ {(sg’-^(a)), o|. (22) 

By simply attributing all the errors to the vacuum pulses, we can upper bound (sg) with 

(sq) < (sg’^) = mm^2^ZJao,oJ^,SzJao.z^,^Jao,x^Y (23) 


III. NUMERICAL SIMULATION 
A. Some special protocols 

Choosing different number of sources in the X and Z bases, we list some protocols in Tab. HI 


Protocol 

Description 

3Int-0 

0 ,Zi,Z 2 ,Xi,X 2 -, Zj = Xj, pzj =PXj, . 

3Int-l 

O, Zi, Z2, Xi\ Zi — Xi, Zi ^ Z2, PZ 2 = 0.479. 

4Int-l 

0 , Zi,Z2,Xi ■ Zi ^ Z2. 

4Int-2 

Zi , Z2 , , ^2 7 Zi -<( Z2 , ^ Z ^2 • 

5Int-l 

0 , Zi, Z2, Xi , X2; Zi ^ Z2, Xi -< X2. 


TABLE I: List of some practical decoy-state methods. O is the vacuum source. Zi and Xr are the sources used by Alice in 
the Z and X bases respectively. The sources are different from each other except when we write the equivalent relations in 
the table, such as Zj = Xj . The probabilities of choosing the sources are independent except for the normalized condition. In 
3Int-0, we also assume Zi -< Z^- 

The first three-intensity protocol 3Int-0 listed in the table is the original symmetric method discussed in Ref. la¬ 
in 3Int-0, Alice uses the vacuum source and two different non-vacuum sources in the Z and X bases to prepare the 
pulses. The symmetric conditions can be described by Zj = Xj, pz^ = px^ for j = 1,2 and with the 

notations presented in this paper. In order to estimate the lower bound of the yield of single-photon pulses, we also 
need to assume Zi -< Zi which indicates that the sources Z\ and Zi fulfill the relations presented in Eq.® with 
tJi = Z\ and (72 = Zi. 

The second three-intensity protocol 3Int-l listed in Tab.IJis the method considered in Ref. [2l|. This is then further 
studied in Ref. with one more free intensity while the security loopholes as discussed earlier in this paper is still 
there and the key rate is not really fully optimized. In 3Int-l, Alice uses the vacuum source, two different sources 
Z\, Zi in the Z basis and only one source Xi in the X basis. The intensities of the source in the X basis is equal to 
the first one in the Z basis, i.e. Zi = Xi. Furthermore, the intensity (weak coherent state used in the simulation) of 
the second source in the Z basis is 0.479. 

In Tab. HI we also list two different four-intensity protocols. The second one, 4Int-2, is a new general protocol 
without the assumption of vacuum, whereas the vacuum source are used in the protocol 4Int-l. Taking the protocol 
4Int-2 as an example, Alice uses two different sources in the Z and X bases respectively. For these four different 
sources, we assume Z\ -< Zi and Ai ^ Xi. In this protocol, we use sources Zi and Xi to extract the final key. 
With Eg. dTCl) . the lower bounds of and s^Xr ‘-an be estimated. The upper bound of ef’'^ can be calculated with 

Eg. dTni) . The upper bound of can also be estimated in the same way. In 4Int-l, the sources Zi and Zi are used 
to extract the final key. 

Besides these three-intensity and four-intensity protocols, we list a five-intensity protocol 5Int-l in Tab. HI In 5Int-l, 
Alice uses the vacuum source, two different sources in the Z and X bases to prepare the pulses. In order to make 
5Int-I contains 4Int-I and 4Int-2 as its special cases, we need to introduce a probability p^i with 0 < ^ PZi- 

With probability j Alice will randomly choose pules from Zi to extract the final key. 

To maximize the key rates, in 3Int-l and 4Int-l, we shall use the following economic worst-case estimation formula 

I? = min[R((s^))] (24) 

(sf> 
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over the region for all possible values of (sq) in (S(f’^)]- Here function R is R = Ri + R 2 and 


Ri =Pziq^ 

- USlH{El)] . 

(25) 

While in the 3Int-0, 4Int-2 and 5Int-l, we 

use the following economic more worst-case estimation for key rates 



R = . min . [^((4)-(s^))] 

(26) 

over the region for all possible values of (s 

f) and (sjf) in [{s^’^),{sq-^)] and [(S(f’■^), respectively. Here 



R{{s^),{4)) = Rx+Rz 

(27) 

and 



Rz = PZ2q^ 

- feSlHiEl)} , 

(28) 

Rx = PX2Q^ 

{a^,x 2 sf:i[l - j} • 

(29) 


Note that in such a case, we need to calculate the final key rate with two variables, (sq) and {sq) jointly. If not using 
this trick, the simple worst-case treatment that treats each one separately will produce a lower key rate. 

In subsection imsi we will compare the results for these protocols with the full parameters optimization. After 
that, we will see that the final key rates obtained with 4Int-2 and 5Int-I are nearly equal to each other. That is to 
say, it is advantageous to use the general protocol 4Int-2 in practice, as it can give an almost optimal key rate and 
has no use for the vacuum source. 


B. Numerical results 

In this subsection, we will present some results of the numerical simulation. We also optimize all parameters by the 
method of full optimization. For a fair comparison, we use all the sifted key corresponding to the successful events 
obtained with X and Z bases to extract the final key. We shall estimate what values would be observed for the 
yields and error yields in the normal cases by the linear channel loss model shown in appendix]^ We use the same 
experimental parameters used in Ref. [ 2 ^ for our numerical simulation, which are also used for simulation in Ref. [2l| . 
The values of these parameters are listed in Table m In the simulation, we also assume that Alice uses the coherent 
states to prepare the pulses. Then the yields S'^. and error yields T^. can be calculated with different intensities. 

By using these values, we can estimate the lower bound of sfz, upper bound of with the 

method presented in Sec. im 


Cd 

Pd 

Vd 

Rea 

3.3% 

1.7 X 10“® 

4.5% 

1.16 10“^“ 0.2 


TABLE II: List of experimental parameters used in numerical simulations. Cd'. the misalignment-error probability, pd'. the 
background counting rate, pd- the detector efficiency, /e: the error correction inefficiency, e: the security bound considered in 
the finite-data analysis, i.e., failure probability, a: the loss coefficient of the standard hber measured in dB/km. 

To make a fair comparison, we make the full parameter optimization for all protocols. Here we also use the well- 
known local search algorithm M- In this algorithm, we need to optimize the one-variable nonlinear function in 
each step for the local search. In the optimization, except for those bits for error test, all bits are used for final key 
distillation. In particular, for protocols 3Int-l, 4Int-I, all bits due to sources Zi, Z^ are used for final key distillation; 
while in protocols 3Int-0, 4Int-2, bits due to sources Z^tX^ are used for final key distillation. In order to make the 
protocol 5Int-l contains 4Int-l and 4Int-2 as its special cases, besides bits due to sources Z^.X^ being used for final 
key distillation, we also need to split the bits due to source Z\ into two parts (one for error test and the other for 
final key distillation) by introducing a probability with 0 < p^i ^ PZi ■ 

We consider the different methods in the case of data-size Nt = 10^°. The optimal key rates of per pulse for 
the distances 80km, 90km, 100km 110km and 120km (standard fiber), with the statistical fluctuations, are shown 
in Table mi Comparing the results with the original symmetric protocol 3Int-0 and the biased-basis protocol 3Int-l 
discussed in Ref. [2lj, the achievable key rate can be significantly improved with our new protocols. 
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80km 90km 100km 110km 120km 

3Int-0 

3Int-l 

3.37e-5 1.73e-5 7.65e-6 2.39e-6 3.91e-8 

5.04e-5 2.38e-5 9.29e-6 2.02e-6 0 

4Int-l 

4Int-2 

5.43e-5 2.65e-5 1.09e-5 2.99e-6 3.65e-8 

5.05e-5 2.39e-5 9.63e-6 3.50e-6 4.55e-7 

5Int-l 

5.43e-5 2.65e-5 1.09e-5 3.50e-6 4.55e-7 


TABLE III: Comparison of the optimal final key rates at different distances (standard fiber) with statistical fluctnation analysis 
in the case of data-size Nt = 10^°(total nnmber of pulses). Results for methods in Tab. [Jare listed here. Comparing with the 
results obtained with the original symmetric protocol 3Int-0 and the biased-basis protocol 3Int-l presented in Ref. [^ . our 
protocols can significantly improve the the key rates. The key rate of our 4Int-2 protocol which does not use vacuum is very 
close to that of the 5Int protocol. Interestingly, the 5Int protocol automatically comes to one of the 4-intensity protocol at each 
distances. This strongly indicates that we have indeed reached the key rate maximization. This also shows that, for a given 
distance, instead of using the 5 intensity protocol, just choosing one of the 4 intensities is enough. 


In Tab. HVl we list the value of parameters with all of them being optimized. In the 1st column, we show the 
parameters for the original symmetric protocol 3Int-0. In the 2nd column, the parameters for the 4-intensity protocol 
4Int-l are listed. In the last column, we exhibit the parameters for our new 4-intensity protocol 4Int-2. 


3Int-0 

4Int-l 

4Int-2 

Pz2 = Px2 = 0.338 

PZ2 = 0.597 

PZ2 ~ 0.260 

Pzi =Pxi = 0.142 

pzt = 0.190 

pzt = 0.077 

Po = 0.040 

pxt =0.112 

PX2 ~ 0.458 


PO = 0.101 

pxt = 0.205 

PZ2 = pX2 ~ 0.390 

^Z2 ~ 0.379 

^Z2 — 0.419 

pzi = pxi =0.116 

pzt = 0.078 

pzt = 0.200 

O 

II 

0 

pxt = 0.255 

PX2 ~ 0.396 


0 

o 

pxt = 0.073 

= 0.5 

q^ = 0.223 

q^ = 0.579 


TABLE IV: Comparison of parameters for the distance 110km (standard fiber) with statistical fluctuation analysis in the case 
of data-size Nt = 10^° for different protocols. In the 1st, 2nd and 3rd columns we list the value of parameters with all of them 
being optimized for 3Int-0, 4Int-l and 4Int-2 respectively, pa^ is the probability to use the source aj in the protocol, po is 
the probability to choose the vacuum source, paj is the intensity of the coherent source aj. is the probability that Bob 
measures the received pulses in the X basis. 

More extensive results are shown in Fig. [T] In this figure, we show the optimal key rate (per pulse) in logarithmic 
scale as a function of the distance under a practical setting with finite data-set Nt = 10^°. In Fig. [1] we use the thin 
magenta dash-dot line, the thin black solid line, the blue dashed line, the red solid line and the green dash-dot line 
to indicate the results obtained with the protocols 3Int-0, 3Int-l, 4Int-l, 4Int-2 and 5Int-I respectively. From the 
numerical simulation, we can conclude that both the achievable key rate and distance can be significantly improved 
by using our new protocols compared with 3Int-0 and 3Int-l. The optimal final key rates obtained by using the 
four-intensity protocol 4Int-2 and the five-intensity protocol 5Int-l are nearly equal to each other. In practical QKD 
applications, for better performance in terms of key rate and distance, it is advantageous to make use of 4Int-2 with 
full parameter optimization, because of the advantage of not using any vacuum source. 

As discussed in Sec. m in order to estimate the final secure key rate, we need to find out the smallest one with 
variable (sq) changing in the region (sjf’^)]. Previously, in Refs. [13, HH, they straightly use the lower bound 

to calculate the final key rate. In order to insure the security, we must make sure that the smallest key rate 
value just happened at the lower bound value of (sq) when we use it to calculate the final key rate directly. However, 
in the numerical simulation, we find some counterexamples. In Fig. after evaluating (sq) with its proper value 
(sf), we plot the key rate R as a function of {sq) with {sq) G [(sq ), (sq )] for the protocol 4Int-2 at the distance 




















FIG. 1: (Color online) Optimal secure key rates (per pulse) in logarithmic scale as as a function of the distance under different 
protocols. Here we set Nt = 10^'^. The key rates are obtained by using numerical methods with 3Int-0 (thin magenta dash-dot 
line), 3Int-l (thin black solid line), 4Int-l (blue dashed line), 4Int-2 (red solid line) and 5Int-l (green dash-dot line). The key 
rates with four-intensity protocol 4Int-2 and five-intensity protocol 5Int-l are almost overlapped. In simulation, we perform a 
full parameter optimization for all cases. 


of 100km. From this figure, we can see that the smallest value of R{{sq)) = R{{sq), (sq)) does not obtained with 
(sq) = {sq’^). In this case, we can not calculate the final key rate with directly. That is to say, if we use the 

lower bound of the yield of vacuum state to calculate the final key rate in this counterexample, the security will not 
be guaranteed. 



FIG. 2: (Color online) The key rate R{{s^)) — R{{s^), (sq)) vs the yield of vacuum state as the variable and (sq) G 
with 4Int-2 for the distance 100km (standard fiber). From this figure, we can see that the smallest values of R 
is not obtained at the lower bounds of (s^). 


IV. CONCLUSION 

We propose to make use of the yields of those pulse which are prepared in one basis and measured in another basis. 
This is to say, we can treat those measurement outcome from different preparation bases jointly provided that they are 
measured in the same basis. Based on this, we present correct formulas for the decoy-state method with considering 
the effects of statistical fluctuations. 

In practice, it is usually difficult to create a perfect vacuum state in decoy-state QKD experiments. In this paper, 
we also present an analytical approach with general decoy states, i.e. without the assumption of vacuum. By taking 
the full parameter optimization with the linear channel loss model, we find that our new 4-intensity protocol 4Int-2 
can give an almost optimal key rate. The vacuum source and more decoy states cannot help to increase the key rate. 

In the simulation, we find some counterexamples in which the lower bound of the final key rate does not obtained 
with the lower bound of the yield of the vacuum state. That is to say, if we use the lower bound of the yield of the 
vacuum state to calculate the final key rate directly in the counterexample, the security will not be guaranteed. So 
we need to find out the smallest key rate with different values of the yield of the vacuum state faithfully. 
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Appendix A: Linear Channel Loss Model 


In order to do the numerical simulations, we need the observed yields and error yields. Here we consider a widely 
used linear channel loss model With this model, the yields and error yields can be simulated. In this model, Alice 
randomly chooses the states for different sources with corresponding probabilities. 

For this model, we define as the overall transmission of the channel when Bob measures the pulses in the oj 
basis {u) = X,Z). It should be note that 77 “ includes the detector efficiency and is measured in dB. In the real setups, 
such as in the situation with different detector efficiencies, the transmissions 77 ^ and are not equal to each other 
rigorously. So we should treat the yields separately with different bases used by Bob to measure the pulses. 

It is reasonable to assume independent between the behaviors of the k photons in a fc-photon state. Therefore the 
transmittance of the fc-photon state rf^ is given by 

77 ^ = I - (I - 7;-)^ (fc = 0,I,2,...) (AI) 

when Bob measures the pulses in the u basis. 

Define ^ to be the yield of an fc-photon state when Alice prepares the state in the a basis and Bob measures in 
the uj basis (w, a = A, Z). Specially, Sq is the background rate. It should be note that is independent of the a 
basis used by Alice to prepare the pulses. Then we can write Sq^ into Sq concisely. 

As discussed above, we need to treat ^ with oj = X and oj = Z separately. In the protocol, there are two detectors 
are used when Bob chooses the w basis to measure the pulses. Furthermore, Bob denote the situation when one and 
only detector makes a count as a successful event. The yield of an fc-photon state, mainly comes from two parts, 
background and true signal. Assuming that the background counts are independent of the signal photon detection, 
then Q, is given by 

= (1 - - (1 - 2s^)(l - r,n% (A2) 

when Alice and Bob choose the same bases, i.e. w = a. Furthermore, we have 

= 2(1 - s-m - rfl2f - (I - s%){\ - 7 ;-)'=], (A3) 

when the bases used by Alice and Bob are different, i.e. 10 ^ a. 

In the ideal case without misalignment error, the error rate of the A:-photon state when Alice and Bob use the same 
bases, is given by 

= (A4) 

In the real setups, we denote as the misalignment error probability. Then the error rate of the fc-photon state is 

efc.Ld = ed(l — 2efc_,^)-I-(A5) 

With these notations, we can write the yields of the pulses prepared from source 07 and measured in the w basis as 




CHj ^k.OL 5 


where the density matrix of source 07 given by Eq. 0 has been used. The error yield is given by 

Tt = ElSl = [e,(I - 2EI) + E^S^, 


(A 6 ) 


(A7) 


when ui = a with E^^ = Furthermore, the error rate of the fc-photon state is always equal to 1/2 when 

Alice and Bob use the different bases. 

If we consider the weak coherent sources, assuming that the phase of each pulse is totally randomized, the density 
matrix of the coherent state with intensity fj, can be written as 


k 


fc! 


|fc)(fc|. 
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With this formula, the yield of the pulses prepared from the weak coherent source aj with density fia^ and measured 
in the w basis is 




(A8) 


when uj = a and 


S-=2{l-s^)e-^[l-{l-s^)e 


when UJ ^ a. The error yield can be simulated by Ea. (IA7l) when a = uj with E^. = Sq (1 — SQ)e 


(A9) 
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